[RESOLVED] Need help with str_replace

[neilmasters]

Hi everyone,
Im relatively new to php and I am looking for help.

I have a script:

// DB info
$db = mysql_connect($host, $user, $pass);
$db_connect = mysql_select_db($name, $db);

if ($db_connect) { 
	$SQL = "SELECT * FROM $table"; $result = mysql_query($SQL); {
		while ($db_field = mysql_fetch_assoc($result)) {
			print "Your key from the db is: "  . $db_field['key'] . "<br />";
		}
	}
	mysql_close($db);
}
else { 
	print "Database NOT Found ";
	mysql_close($db);
}

The database entry can be anything, im sure some of you can see where i am going with this.

This means someone can stick a nice little malicious <script> tag in there, or anything of nastyness.

I have been reading about str_replace etc and see this as a valid way to go, however I am an idiot and have tried several mashup ways of doing it according to several internet articles, none of them work or throw back errors, so obviously I am doing something wrong.

I have also looked at htmlspecialentities, however It is not just < > etc etc characters that I want to do a str_replace on, I would like to future proof the application so that I can also do str_replace on any peice of data.

Any help would be lovely.

[Krik]

You should look into mysql_real_escape_string() it's purpose is to prevent sql injection attacks.

Of course over time I have added a few things for dealing with various problems and now do thing like this.

$data = strtr(htmlentities($_POST['data'], ENT_QUOTES), array('(' => '(', ')' => ')'));

$data= mysql_real_escape_string($data);

EDIT
Unfortunatly the forums are not allowing me to use &#40 or &#41 in that array so you aren't seeing it as I intended

[neilmasters]

Thanks that actually really helped me.

What I have ended up doing is creating an array, a good and bad:

config.inc.php:

$bad = array('<', '>');
$good = array('&lt;', '&gt;');
...

template_1.php:

...
print str_replace($bad, $good, $title);
...

However I will look at the suggestion you provided and improve what I have outstanding.